About SARowe_NZ

Cool thanks for that - really appreciate all your help! ... View more

Thanks - given I'd be starting at the zero with python the learning curve would be too much and I'd need to dedicate too much time to justify it just for this. I have not looked at the powershell option though so that could definitely work, as I suspect it is much simpler for a script notice like me - I will check it out!   Cheers, Shannon ... View more

Hey, That was an example - its actually lots of different configuration elements (policies / objects / VPNs etc). I'm moving config around between firewalls and different Templates/Device Groups on our Panorama. For the most part it is quite granular (per policy / vpn etc) which is the challenge. If it was all of them I could just use the root x-path for (e.g.) policies as the root x-path would have no spaces, but unfortunately much of this has to be done at individual item level.   Cheers, Shannon ... View more

Hey Daniel, Thanks for that - appreciate your help! Unfortunately my knowledge of python is zero.   Surely it must be possible to parse a space in the CLI x-path call. Cheers, Shannon ... View more

Hey - thanks for the response, unfortunately I have tried that and it still does not accept it. Does not like the syntax. I tried with single and double quotes. Thanks, Shannon ... View more

Note: just to clarify the actual policy name is " Policy Name Here" - the XML API Browser adds the "+" symbols shown in the original post automatically wherever a space exists, but the x-path call from the CLI does not seem to accept it. ... View more

Hey, Thanks for the response. Yes I have tried not selecting Option A and I do have a policy file and a Rulebase file. The Objects_5_0.C definitely contains data.   Anyone have any ideas? Really hoping to use the Expedition tool for this as migrating these manually will be a nightmare...   Cheers, Shannon ... View more

Hi, Thanks for the replies. I also found this article: http://michlstechblog.info/blog/windows-set-permissions-on-a-service/ This will resolve the issue but need to find a way to deploy it easily (eg via GPO). I will take a bit more detailed look at your suggestions as suspect a combination will provide the answer. Surprised PAN don't have tamper protection enabled natively, like is available in Traps. Thanks again, Shannon ... View more

Thanks Varun, " With 5.1 GlobalProtect App, as an admin, you can set Disable Option to Not Allow on Dynamic App Config on the firewall to prevent users from disabling GlobalProtect." Will that also prevent users from stopping the actual GP service? We already have it configured to stop users from disabling it through the GP App, and that works, but they have found they can simply go into services.msc and disable the service, then kill the GP app through task manager. This effectively allows them to completely turn off GP.   The only difference there is we are currently using agent version 4.1.x not 5.1. ... View more

Thanks Steve! ... View more